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AMENDMENTS TO THE CLAIMS 

This listing of claims replaces all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (Currently Amended) In a computing device that may be communicatively 
coupled to a network by a network communication path that includes one or more network 
protocol stacks associated with and an abstract interface , the abstract interface situated at a 
relative location within each of the one or more protocol stacks between a transport layer and 
a data link layer respectively, the abstract interface i er- solely_managing access to a 
communication filter stac k for the one or more network protocol stacks , the communication 
filter stack including one or more communication filter instances , which may configured to 
perform data filtering operations on data packets being transferred via the one or more 
network protocol stacks when the data packets are accessed at the abstract interface 
communication path , a method for inserting a communication filter instance into the-a 
communication filter stack without disrupting the operation o f associated the one or more 
network protocol stacks the abstract interface is situated within so as to conserve processor 
and network resources, the method comprising: 

an act of the abstract interface pausing operation of the— an operational 
communication filter stac k to transition the operational communication filter stack to a 
paused communication filter stack without disrupting operation of the one or more 
network protocol stacks ; 

an act of the abstract interface transferring at least one data packet between a 
transport layer and data link driver of a protocol stack the abstract interface is situated 
within without performing any data filtering operations on the data packet subsequent to 
transitioning the operational communication filter stack to a paused communication filter 
stack and while the paused communication filter stack remains paused; 

an act of the abstract interface causing inserting the a communication filter 
instance to be inserted into the paused communication filter stack while at least one 
associated the one or more network p rotocol stacks continues to be capable of 
transferring dat a between corresponding transport and data link layers ; and 

an act of the abstract interface re starting the paused communication filter stack to 
transition the paused communication filter stack back into the operatio nal communication 
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of the filter stack without disrupting operation of the one or more network protocol 
stacks . 

2. (Currently Amended) The method as recited in claim 1, wherein pausing 
operation of the an operational communication filter stack comprises the following: 

an act of pausing one or more communication filter instances included in the 
operational communication filter stack. 

3. (Currently Amended) The method as recited in claim 2, wherein pausing one or 
more communication filter instances included in the operational communication filter stack 
comprises the following: 

an act of one or more pause routines receiving data indicating that the one or more 
communication filter instances should be paused. 

4. (Currently Amended) The method as recited in claim 1, wherein pausing 
operation of the an operational communication filter stack comprises the following: 

an act of redirecting a transferred data packet to a dummy routine that returns the 
data packets back to the abstract interface th e communication path without modifying the 
data included in the data packet. 

5. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting th e a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting a communication filter instance that was configured by using 
parameters received from the abstract interface. 

6. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of a communication filter driver receiving a filter handle that may be used 
to facilitate transferring data to an abstract interface. 
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7. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of a communication filter driver allocating resources for the 

communication filter instance. 

8 (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of a communication filter driver creating a filter instance context for the 

communication filter instance. 

9. (Currently Amended) The method as recited in claim 8, wherein a communication 
filter driver creating a filter instance context for the communication filter instance comprises the 
following: 

an act of the communication filter driver sending the filter instance context to the 
abstract interface. 

10. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing in s erting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of a communication filter driver registering data with the abstract interface. 

11. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of a communication filter driver registering data in a system registry. 



Page 4 of 28 



Application No. 10/020,286 

Amendment "A" dated September 18, 2006 

Reply to Office Action mailed June 7, 2006 

12. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting a communication filter instance that was configured by using 
parameters received from a system registry. 

13. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting th e a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting the communication filter instance in a predetermined location 
in the paused filter stack. 

14. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting a communication filter instance that is capable of filtering data 
packets transferred over virtual connections. 

15. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting th e a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting a communication filter instance that includes an entry point to 
receive data associated with the power management of the computing device. 

16. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting th e a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting a communication filter instance that includes an entry point to 
receive data associated with plug and play devices. 
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17. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of inserting a communication filter instance that includes properties that 

may be modified through a management interface. 

Claim 18. (Cancelled) 

19. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface causing inserting the a communication filter instance to be inserted into the paused 
communication filter stack comprises the following: 

an act of a communication filter driver verifying that the communication filter 

instance was inserted into the paused filter stack. 



20. (Currently Amended) The method as recited in claim 19, wherein a 
communication filter driver verifying that the communication filter instance was inserted into the 
paused filter stack comprises the following: 

an act of the communication filter driver sending an insertion status to the abstract 
interface. 

21. (Currently Amended) The method as recited in claim 1, wherein the abstract 
interface re starting the paused communication filter stack operation of the filter stack comprises 
the following: 

an act of starting one or more communication filter instances included in the 
paused communication filter stack. 

22. (Currently Amended) The method as recited in claim 21, wherein starting one or 
more communication filter instances included in the communication filter stack comprises the 
following: 

an act of one or more start routines receiving data indicating that the one or more 
communication filter instances should - are to be started. 
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23. (Currently Amended) The method as recited in claim 1, further comprising: 

an act of notifying associated network p rotocol stacks that operation of the 
operational communication filter stack is going to be paused. 

24. (Currently Amended) The method as recited in claiml, further comprising: 

an act of notifying associated network protocol stacks that the o perational 
communication filter stack now includes the inserted communication filter instance. 

25. (Currently Amended) The method as recited in claim 1, further comprising 

an act of notifying associated network protocol stacks that operation of the paused 
communication filter stack is going to be restarted. 
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26. (Currently Amended) In a computing device that may be communicatively 
coupled to a network by a network communication path that includes one or more network 
protocol stacks associated with and an abstract interfac e, the abstract interface situated at a 
relative location within each of the one or more protocol stacks between an transport layer and a 
data link layer respectively, the abstract interface for — solely managing access to a 
communication filter stack for the one or more network protocol stacks , the communication filter 
stack including one or more communication filter instances configured to perform data filtering 
operations on data packets being transferred via the one or more network protocol stacks when 
the data packets are accessed at the abstract interface , a method for removing a communication 
filter instance from the a communication filter stack without disrupting the operation of 
associated the one or more network protocol stacks the abstract interface is situated within so as 
to conserve processor and network resources, the method comprising: 

an act of the abstract interface pausing operation of the— an operational 
communication filter stack to transition the operational communication filter stack to a 
paused communication filter stack without disrupting operation of the one or more 
network protocol stacks ; 

an act of the abstract interface transferring at least one data packet between a 
transport layer and data link driver of a protocol stack the abstract interface is situated 
within without performing any data filtering operations on the data packet subsequent to 
transitioning the operational communication filter stack to a paused communication filter 
stack and while the paused communication filter stack remains paused; 

an act of the abstract interface causing removing the a communication filter 
instance to be removed from the paused communication filter stack while at l e ast one 
associated the one or more protocol stacks continues to be capable of transferring data 
between corresponding transport and data link layers ; and 

an act of the abstract interface re starting the paused communication filter stack to 
transition the paused communication filter stack back into the operatio nal communication 
of the filter stack without disrupting operation of the one or more network protocol 
stacks . 
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27. (Currently Amended) The method as recited in claim 26, wherein the abstract 
interface p ausing operation of the an operational communication filter stack comprises the 
following: 

an act of pausing one or more communication filter instances included in the 
communication filter stack. 

28. (Currently Amended) The method as recited in claim 27, wherein the abstract 
interface pausing one or more communication filter instances included in the communication 
filter stack comprises the following: 

an act of one or more pause routines receiving data indicating that the one or more 
communication filter instances should be paused. 

29. (Currently Amended) The method as recited in claim 26, wherein the abstract 
interface pausing operation of a -an operational communication filter stack comprises the 
following: 

an act of redirecting transferred data packets to adummy routines that returns the 
data packets back to the abstract interface th e communication path without modifying the 
data included in the data packet . 

30. (Currently Amended) The method as recited in claim 26, wherein the abstract 
interface causing r emoving th e a communication filter instance to be removed from the paused 
communication filter stack comprises the following: 

an act of pausing the communication filter instance. 

31. (Currently Amended) The method as recited in claim 26, wherein the abstract 
interface causing removing the a communication filter instance to be removed from the paused 
communication filter stack comprises the following: 

an act of a communication filter driver releasing resources associated with the 
communication filter instance. 
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32. (Currently Amended) The method as recited in claim 26, wherein the abstract 
interface re starting operation of the paused communication filter stack comprises the following: 

an act of starting one or more communication filter instances included in the 
paused communication filter stack. 

33. (Currently Amended) The method as recited in claim 32, wherein starting one or 
more communication filter instances included in the paused communication filter stack 
comprises the following: 

an act of one or more start routines receiving data indicating that the one or more 
communication filter instances shou4d- are to be started. 

34. (Currently Amended) The method as recited in claim 26, further comprising: 

an act of notifying associated network protocol stacks that operation of the 
operational communication filter stack is going to be paused. 

35. (Currently Amended) The method as recited in claim 26, further comprising: 

an act of notifying associated network protocol stacks that communicaiton filter 
instance has been removed from the operational filter stack. 

36. (Currently Amended) The method as recited in claim 26, further comprising 

an act of notifying associated network protocol stacks that operation of the paused 
communication filter stack is going to be restarted. 
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37. (Currently Amended) In a computing device that may be communicatively 
coupled to a network by a network communication path that includes one or more network 
protocol stacks associated with and an abstract interface , the abstract interface situated at a 
relative location within each of the one or more protocol stacks between an transport layer and a 
data link layer respectively, the abstract interface fer — solely managing access to a 
communication filter stack for the one or more network protocol stacks , which may perform 
filtering operations on portions of data packets being transferred via th e communication path, 
configured to perform data filtering operations on data packets being transferred via the one or 
more network protocol stacks when the data packets are accessed at the abstract interface, a 
method for reconfiguring inserting a filter instance into the communication filter stack without 
disrupting the operation of associated the one or more network protocol stacks the abstract 
interface is situated within so as to conserve processor and network resources, the method 
comprising: 

an act of the abstract interface pausing operation of the — an operational 
communication filter stac k to transition the operational communication filter stack to a 
paused communication filter stack without disrupting operation of the one or more 
network protocol stacks ; 

an act of the abstract interface transferring at least one data packet between a 
transport layer and data link driver of a protocol stack the abstract interface is situated 
within without performing any data filtering operations on the data packet subsequent to 
transitioning the operational communication filter stack to a paused communication filter 
stack and while the paused communication filter stack remains paused; 

a step for the abstract interface reconfiguring filtering operations included in the 
filter stack in a manner that promotes efficient transfer of data along the network 
communication path such that the one or more protocol stacks continue to be capable of 
transferring data between corresponding transport and data link layers during 
reconfiguration. 



Page 11 of 28 



Application No. 10/020,286 

Amendment "A" dated September 18, 2006 

Reply to Office Action mailed June 7, 2006 



38. (Withdrawn) In a computing device that may be communicatively coupled to a 
network by one or more communication paths and that includes one or more protocol stacks 
associated with an abstract interface that manages one or more filter instances that may 
perform filtering operations on packets, a method for filtering packets associated with the one 
or more protocols so as to conserve processor and network resources, the method comprising: 

an act of processing an input packet; 

an act of the input packet bypassing one or more of the filtering operations 
associated with a filter instance; and 

an act of sending an output packet that may differ from the input packet if a 
filtering operation was performed. 

39. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet comprises the following: 

an act of processing an input packet associated with a data link layer. 

40. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet associated comprises the following: 

an act of processing an input packet associated with a data link layer driver. 

41. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet comprises the following: 

an act of processing an input packet associated with a transport layer protocol. 

42. (Withdrawn) The method as recited in claim 41, wherein processing an input 
packet associated with a transport layer protocol comprises the following: 

an act of processing an input data packet associated with the Transmission Control 
Protocol. 

43. (Withdrawn) The method as recited in claim 41, wherein processing an input 
packet associated with a transport layer protocol comprises the following: 

an act of processing an input data packet associated with the Internet Protocol. 
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44. (Withdrawn) The method as recited in claim 41, wherein processing an input 
packet associated with a transport layer protocol comprises the following: 

an act of processing an input packet from a transport layer driver. 

45. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet compromises the following: 

an act of processing a data packet transferred along a data path from a transport layer to a 
data link layer. 

46. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet compromises the following: 

an act of processing a data packet transferred along a data path from a data link layer to a 
transport layer. 

47. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet compromises the following: 

an act of processing a control packet, which includes request information, and is being 
transferred along a control path. 

48. (Withdrawn) The method as recited in claim 38, wherein processing an input 
packet compromises the following: 

an act of processing a control packet, which includes system indication information, and 
is being transferred along a control path. 

49. (Withdrawn) The method as recited in claim 38, wherein the input packet 
bypassing one or more of the filtering operations associated with a filter instance comprises the 
following: 

an act of a received input packet bypassing one or more internal filtering 
operations associated with a filter instance included in a filter stack. 
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50. (Withdrawn) The method as recited in claim 38, wherein the input packet 
bypassing one or more of the filtering operations associated with a filter instance comprises the 
following: 

an act of a received input packet bypassing one or more internal filtering 
operations associated with a filter instance based on characteristics associated with the 
input packet. 

51. (Withdrawn) The method as recited in claim 38 wherein, the input packet 
bypassing one or more of the filtering operations associated with a filter instance comprises the 
following: 

an act of the input packet completely bypassing the filter instance. 

52. (Withdrawn) The method as recited in claim 51, wherein the input packet 
completely bypassing the filter instance comprises the following: 

an act of the input packet completely bypassing the filter instance because the 
filter instance was configured to operate in bypass mode for the communication path along 
which the input packet is being transferred. 

53. (Withdrawn) The method as recited in claim 50, wherein the input packet 
bypassing one or more filtering operations associated with a filter instance based on 
characteristics associated with the input packet comprises the following: 

an act of bypassing a first set of filtering operations when an input packet is 
associated with a first protocol and bypassing a second set of filtering operations when an 
input packet associated with a second protocol. 

54. (Withdrawn) The method as recited in claim 53, wherein the first set of filtering 
operations and the second set of filtering operations are different. 

55. (Withdrawn) The method as recited in claim 38, wherein sending an output packet 
that may differ from the input packet if a filtering operation was performed on the input packet 
comprises the following: 
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an act of sending an output packet that may differ from the input packet if £ 
filtering operation modified the input packet. 
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56. (Withdrawn) In a computing device that may be communicatively coupled to a 
network by one or more communication paths and that includes one or more protocol stacks 
associated with an abstract interface that manages a filter stack, a method for filtering packets 
associated with the one or more protocols so as to conserve processor and network resources, 
the method comprising: 

an act of receiving an input packet associated with a protocol; 
a step for transferring an output packet the may have been filtered by some but 
not all of the filtering operations included in a filter stack so as to increase efficiency of 
the filtering process. 
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57. (Withdrawn) In a computing device that may be communicatively coupled to a 
network by one or more communication paths and that includes one or more protocol stacks 
associated one or more filter instances that may perform filtering operations on packets, a 
method for filtering packets associated with the one or more protocols so as to conserve 
processor and network resources, the method comprising: 

an act of a filter instance receiving an input packet; 

an act of bypassing a first set of filtering operations when the input packet is 
transferred across a communication path from a data link layer to a transport layer and 
bypassing a second set of filtering operations when the input packet is transferred across 
a communication path from a transport layer to a data link layer; and 

an act of sending an output packet that may differ from the input packet if a 
filtering operation was performed. 

58. (Withdrawn) The method as recited in claim 57, wherein the first set of filtering 
operations and the second set of filtering operations are different. 

59. (Withdrawn) The method as recited in claim 57, wherein the communication path 
is a data path. 

60. (Withdrawn) The method as recited in claim 57, wherein the communication path 
is a control path. 
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61. (Withdrawn) In a computing device that may be communicatively coupled to a 
network by one or more communication paths and that includes one or more protocol stacks 
associated one or more filter instances that may perform filtering operations on packets, a 
method for filtering packets associated with the one or more protocols so as to conserve 
processor and network resources, the method comprising: 

an act of a processing a packet currently being transferred across a 
communication path; 

an act of the packet completely bypassing a first filter instance in the 
communication path because the first filter instance was configured to operate in bypass 
mode for the communication path; and 

an act of the packet being received by a second filter instance in the 
communication path that was configured to receive packets being transferred across the 
communication path. 

62. (Withdrawn) The method as recited in claim 61, wherein the packet completely 
bypassing a first filter instance in the communication path because the first filter instance was 
configured to operate in bypass mode for the communication path comprises the following: 

an act of the packet completely bypassing a first filter instance in the 
communication path because the first filter instance was configured by an abstract 
interface to operate in bypass mode for the communication path 

63. (Withdrawn) The method as recited in claim 62, further comprising: 

an act of the abstract interface configuring the filter instance to resume receiving 

packets. 

64. (Withdrawn) The method as recited in claim 61, an act of the packet completely 
bypassing a first filter instance in the communication path because the first filter instance was 
configured to operate in bypass mode for the communication path wherein comprises the 
following: 
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an act of an input data packet completely bypassing a first filter instance in a data 
path because the first filter instance was configured to operate in bypass mode for the data 
path. 

65. (Withdrawn) The method as recited in claim 61, an act of the packet completely 
bypassing a first filter instance in the communication path because the first filter instance was 
configured to operate in bypass mode for the communication path wherein comprises the 
following: 

an act of an input control packet completely bypassing a first filter instance in a 
control path because the first filter instance was configured to operate in bypass mode for 
the control path. 
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66. (Currently Amended) A computer program product for use at implementing, in a 
computing device that may be communicatively coupled to a network by a communication 
path that includes one or more network protocol stacks associated with and an abstract 
interface situated at a relative location within each of the one or more protocol stacks 
between a transport layer and a data link layer respectively, the abstract interface fo r - solely 
managing access to a communication a filter stack for the one or more network protocol 
stacks , which may perform filt e ring operations on portions of data packets being transferred 
via the communication filter stack path, a m e thod for inserting including one or more a 
communication filter instance s configured to perform data filtering operations on data 
packets being transferred via the one or more network protocol stacks when the data packets 
are accessed at the abstract interface, the computer program product of implementing a 
method for inserting a communication filer instance into the communication filter stack 
without disrupting the operation of associated the one or more protocol stacks the abstract 
interface is situated within so as to conserve processor and network resources, the computer 
program product comprising: 

a physical computer-readable medium carrying having stored thereon computer- 
executable instructions, that when executed at the computing device cause the computing 
device to perform the method, including: 

an act of the abstract interface pausing operation of the -an operational 
communication filter stac k to transition the operational communication filter stack 
to a paused communication filter stack without disrupting operation of the one or 
more network protocol stacks ; 

an act of the abstract interface transferring at least one data packet 
between a transport layer and data link driver of a protocol stack the abstract 
interface is situated within without performing any data filtering operations on the 
data packet subsequent to transitioning the operational communication filter stack 
to a paused communication filter stack and while the paused communication filter 
stack remains paused; 

an act of the abstract interface causing inserting the a communication filter 
instance to be inserted into the paused communication filter stack while at least 
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one associated the one or more network p rotocol stacks continues to be capable of 
transferring dat a between corresponding transport and data link layers ; and 

an act of the abstract interface re starting the paused communication filter 
stack to transition the paused communication filter stack back into the operational 
communication ef-the-filter stack without disrupting operation of the one or more 
network protocol stacks . 
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67. (Currently Amended) A computer program product for use at implementing, in a 
computing device that may be communicatively coupled to a network by a network 
communication path that includes one or more network protocol stacks and associated with 
an abstract interface , the abstract interface situated at a relative location within each of the 
one or more protocol stacks between a transport layer and a data link layer respectively, the 
abstract interface fe r - solely managing access to a communication a filter stac k for the one or 
more network protocol stacks , the communication filter stack including one or more 
communication filter instances, which may configured to perform data filtering operations 
on portions of data packets being transferred via the one or more network protocol stacks 
when the data packets are accessed at the abstract interface communication path , the 
computer program product for implementing a method for inserting removing a 
communication filter instance inte from the - a communication filter stack without disrupting 
the operation of associated the one or more network protocol stacks the abstract interface is 
situated within so as to conserve processor and network resources, the computer program 
product comprising: 

a physical computer-readable medium carrying computer-executable instructions, 
that when executed at the computing device cause the computing device to perform the 
method, including: 

an act of the abstract interface pausing operation of the -an operational 
communication filter stac k to transition the operational communication filter stack 
to a paused communication filter stack without disrupting operation of the one or 
more network protocol stacks ; 

an act of the abstract interface transferring at least one data packet 
between a transport layer and data link driver of a protocol stack the abstract 
interface is situated within without performing any data filtering operations on the 
data packet subsequent to transitioning the operational communication filter stack 
to a paused communication filter stack and while the paused communication filter 
stack remains paused; 

an act of the abstract interface causing removing the a communication 
filter instance to be removed from the paused communication filter stack while at 
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least one associated the one or more protocol stacks continues to be capable of 
transferring dat a between corresponding transport and data link layers ; and 

an act of the abstract interface re starting the paused communication filter 
stack to transition the paused communication filter stack back into the operational 
communication e f-the-filter stack without disrupting operation of the one or more 
network protocol stacks . 
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68. (Withdrawn) A computer program product for implementing, in a computing 
device that may be communicatively coupled to a network by one or more communication 
paths and that includes one or more protocol stacks associated with an abstract interface that 
manages a filter stack, the filter stack including one or more filter instances that may perform 
filtering operations on portions of packets, a method for filtering packets associated with the 
one or more protocols so as to conserve processor and network resources, the computer 
program product comprising: 

a computer-readable medium carrying computer-executable instructions, that 

when executing at the computing device cause the computing device to perform the 

method, including: 

an act of processing an input packet; 

an act of the input packet bypassing one or more of the filtering operations 
associated with a filter instance; and 

an act of sending an output packet that may differ from the input packet if 
a filtering operation was performed on the input packet. 
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